On May 25th 2018, the EU General Data Protection Regulation comes into effect in Europe to help harmonize personal privacy rights across all 28 EU member states. While individual countries can maintain their own privacy laws and impose additional penalties, GDPR establishes a common baseline of protections for citizens (and residents) of the EU and for collectors and processors of personal data–a set of common obligations and potential fines (up to 4% of global revenue per company per country).

Whose Data Is it Anyway?

One of the more foundational innovations of GDPR is the idea of institutionalizing a fundamental right to one’s data. Under GDPR, every EU citizen (or resident) has a right to access, port or erase their data. Companies that collect and process consumer or employee data, i.e. controllers, are effectively obligated to return an individual’s data upon request. GDPR re-orients the balance of rights and obligations between a data owner and a data processor. People never lose their right to data about them or by them, while companies in turn are transformed into data custodians with new obligations for the data they steward on behalf of the data owners.

This new principle is nowhere more famously manifest than in the principle of Right-to-be-Forgotten. While the idea of Right-to-be-Forgotten preceded GDPR in Europe and elsewhere, GDPR elevates the concept up and removes any ambiguity around the obligation. Under GDPR, EU citizens and residents have a fundamental right to have their data deleted upon request. There is no test as to whether the data is mistaken. The data belongs to the individual and they can do with the data as they see fit.

What’s the Point of Data Controllers without Data Controls?

For companies that collect and process personal information, this new right to one’s data represents a sea change in how they view and manage their data. Since the inception of databases, personal data has been viewed more as a literal commodity as reflected in the terms used to describe where you keep it: data store, data warehouse, data lake. Understanding the identity of the data owner, inasmuch as it existed, served the primary purpose of personalization and prediction. It was–and largely remains–all about “analyze so as to monetize.”

But GDPR helps put the “person” back in personal data. It reminds companies that the data belongs to an individual to whom they are accountable and for whom they must provide an accounting. Knowing a person’s data, however, has value beyond the intelligence. Data unknown is not invisible, it’s just vulnerable to theft, misuse, and compromise. To meet the new GDPR requirements requires companies to find and inventory data by person. This in turn creates new opportunities for data protection, compliance, and governance. Right-to-be-Forgotten ultimately ensures that every person’s data is not forgotten. Indirectly the new personal data rights enable better safeguarding for personal data whether Social Security number or IP address.

Data Driven Personal Data Governance & Protection

Regulations have historically helped companies focus their attention and equally their budget. In the US, regulations like Sarbanes (SOX), HIPAA, PCI, to name just a few, drove companies to reset priorities and rethink approaches to dealing with data and applications. As the US is a country synonymous with industrialization, this has invariably led to the adoption of new kinds of technology automation with memorable acronyms like SIEM, SSO, DLP, DAM and DRM. But every innovation answers its unique problem and so these innovations spoke to a specific pain at a specific point in time. Individual rights to access, port or erase their data speak to a new set of requirements and therefore a new set data governance, protection and compliance requirements.

While GDPR defines a new benchmark of regulations around personal privacy it is not alone in driving this new era around personal data governance and protection. China has just instituted a similar right along with many other countries. Similarly, in the US, several states are debating bills that would enshrine new rights to personal data. For companies this means a new kind of data governance, protection and compliance is required that can account for a person’s data and ensure data accountability to that person. Not surprisingly a new generation of companies like BigID aim to fill the vacuum with technology that helps companies meet the new obligations while being more accountable and transparent to their customers and employees.

@dimitrisirota